Splunk Search

replace found data with "fix" and no data with "NULL"

CharterBT
Explorer

I'm trying to perform a search where if there is data found in a specific field , then I want the report to replace that data with the word "fix". Conversely, if the field is empty, then I want the word "NULL" to display in my results.

Every time I try it, it seems my NULL values are getting overwritten and all I'm getting are "fix" in the cs5 field.

Any help is appreciated. Thanks in advance!

0 Karma

dwaddle
SplunkTrust
SplunkTrust

There's probably another way of doing it too...

| rex mode=sed field=foo "s/^.+$/fix/"
| eval foo=coalesce(foo,"NULL") 

alacercogitatus
SplunkTrust
SplunkTrust

Easy enough. So first, fill in your nulls with a value to check. Then in your stats, match on those that are null, and those that aren't null.

your_search | fillnull value="nullify" FIELDNAME | stats count(eval(searchmatch("FIELDNAME='nullify'"))) AS FOUND_NULL count(eval(searchmatch("FIELDNAME!='nullify'"))) AS FOUND_DATA

EDIT: updated searchmatch to make sure you are matching on the field. Per docs, searchmatch argument is a search string.

CharterBT
Explorer

lukejadamec got it to work for me, but thanks for all of your help as well! Have a great day!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Can you post the actual fieldname, and the search you just tried?

0 Karma

CharterBT
Explorer

This is the closest I've gotten to the results I need, because it created two columns labeled "Found Null" and "Found Data". But it grouped all the results under Found Data, and my previous queries have 70%+ of my results have null. I replaced FIELDNAME with the name of the field I'm wanting to change/count. What other part of this example do I have to change for this to work? I'm not familiar with searchmatch.

0 Karma

CharterBT
Explorer

Yes for the fillnull value.

I've tried to just use
replace [*] with [fix], but now it's giving me a search error.

I'm very new to Splunk, but here's the (latest version of the) part of the query I'm trying to run.

| fillnull value=NULL cs5 | replace [*] with [fix] cs5 |

I know that's probably the reason that all I was getting were "fix" results because the wildcard is catching everything. I'm not sure how to tell Splunk to differentiate between found data and NULL. And I need a null value so that I can get Splunk to count the instances of null.

0 Karma

lukejadamec
Super Champion

Try using

| fillnull value=NULL cs5 |

for your 'Null' results?

And,

| eval cs5 = case(cs5="NULL","NULL",1=1,"fix") |

for your 'fix' replacement. Treat text as case sensitive.

CharterBT
Explorer

BINGO! That did it! Thanks for your help and teaching me a new trick in Splunk, too!

0 Karma

lukejadamec
Super Champion

Sorry, yes the fieldname should be cs5, and you need to add quotes to the text in the case statement. No quotes around numbers or field names. I updated the answer.

0 Karma

CharterBT
Explorer

OK, I realize that in your first example, I change fieldname to actual name of the field (in my case, cs5). Do I change the word "case" in your second example? I ask because I ran it "as-is" for the second example, and I still was unable to get results that group into the two types I need.

0 Karma

lukejadamec
Super Champion

Try case instead. The 1=1 is a default true that should match all non-NULL values. The NULL values will not make it to the end of the statement, so they should be ok.

0 Karma

CharterBT
Explorer

Sorry, I was probably being unclear.

The eval fieldname query you suggested didn't replace any found data with the word "fix".

The fieldname that I'm focusing on could capture any combination of letters or numbers - if there's data in the field, I need to replace it with the word "fix". I don't need to retain the data, I just need a count.

If there's no data, I need the word "null" in that field. Then I can get a count of those as well.

This seems like it should be an easy query, but then again, these really basic queries can sometimes be harder than I think.

0 Karma

lukejadamec
Super Champion

Are you using
| fillnull value=NULL fieldname |
for your 'Null' results?
What are you using for you 'fix' results?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...